From 6f9ae391deeab618fc9c0080d05b97afa29ddf81 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 12 Feb 2013 22:14:50 +0100 Subject: [PATCH] faxcompr: Dont read ref when the end has been reached in pass mode Fixes reading over the end Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/faxcompr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavcodec/faxcompr.c b/libavcodec/faxcompr.c index 3e51a3e793..86be97792e 100644 --- a/libavcodec/faxcompr.c +++ b/libavcodec/faxcompr.c @@ -170,10 +170,12 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb, return -1; } if(!cmode){//pass mode - run_off += *ref++; + if(run_off < width) + run_off += *ref++; run = run_off - offs; offs= run_off; - run_off += *ref++; + if(run_off < width) + run_off += *ref++; if(offs > width){ av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n"); return -1;